Devops Finland - AWS Codepipeline CD/CI

Transcript

1. 1 Continuous delivery with CodeBuild and CodePipeline By Erik Östman 05/2019
2. Who am I? • My name is Erik Östman, part of the Payments team • Payments team develops and maintains customer facing payment systems • We have two different products: • Checkout: a payment page shared between touchpoints • Payment Gateway: A service that allows us to combine several PSP’s and combine them under one API • Our team is about one year old, we started “fresh” 2
3. Why CodePipeline and Codebuild? • We started out with Jenkins with shared ownership • Wasn’t working out very well • We used travis for Pull Requests, but the concurrent build was an issue for us • Codebuild is charged per minute, and is baked into our AWS costs J • Also makes it visible to the team what they are using • It uses IAM to restrict access, so very fined grained access control • Works well with AWS, surprise • It is in the teams control, as a managed service 3
4. Example checkout pipeline 4
5. Our journey so far • The Payments team has two codepipelines • One for Checkout • One for Payment Gateway • We started with a one account pipeline with many environments, but all in that same account for checkout. • Our next pipeline was created for the Payment gateway which lives in three different accounts, and the deployment/ pipeline is run in one of them. • The codepipline assumes a role in the account where it should deploy • Hotfixing is hard 5
7. Quality gates in our CI / CD 7 • Browser tests, • Runs inside CodeBuild for Pull Requests and in the buildphase of the CodePipeline. Then we run them against each environment after deployment except production • Api tests, • Running similarly to browser tests • Unit tests, • Running in PR’s and in the build phase • Smoke tests • Running after production deployments ( a smaller subset because of production limitations, need real cards etc) • Manual review button for going to production
11. Our next steps 11 • CodeDeploy • We took a shortcut and used Codebuild also to make deployments, this works fine as we can script whatever. But there are things that CodeDeploy could help us with, e.g blue green deployments, rolling out releases. Automatic rollbacks • Use CDK ( AWS Cloud Development Kit) to programmatically describe the pipeline instead of using cloudformation, which becomes a little repetetive especially when you have larger pipeliens • Incorporate more Quality control into the pipeline, • Security checks, OWASP ZAProxy API scan • Mobile device testing, AWS Device Farm • Running our visual regression tests automatically in the pipeline